Restricting AKS API server access to specific networks is done with authorized IP address ranges

AZ-500 By islever Editorial Last updated

Plan and implement advanced security for compute

Short answer

A Configure authorized IP address ranges on AKS1 to allow API server access only from specific networks with minimal effort.

Question

You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1. You have an Azure container registry that stores container images that were deployed by using Azure DevOps Microsoft-hosted agents. You need to ensure that administrators can access AKS1 only from specific networks. The solution must minimize administrative effort. What should you configure for AKS1?
  1. authorized IP address ranges Correct Answer
  2. an Application Gateway Ingress Controller (AGIC)
  3. a private endpoint
  4. a private cluster

Key Takeaways

Authorized IP ranges are the lightweight, built-in control for 'access only from specific networks'. A private cluster or private endpoint changes the network topology and costs more to operate; the question's 'minimize administrative effort' points to authorized IP ranges.

To let administrators reach the AKS API server only from specific networks, you configure authorized IP address ranges on the cluster. This lets you allowlist the IP ranges (such as your admin jump-host or corporate CIDR) that can reach the Kubernetes API server, with minimal operational overhead.

Common mistake: Candidates pick a private cluster or private endpoint, but those isolate the API server on a private network rather than allowlisting specific admin networks; the direct 'only from specific networks' control is authorized IP address ranges.

Expert Analysis

Why the Answer Is Correct

Authorized IP address ranges let you specify the CIDR ranges permitted to access the AKS API server. When you need administrators to reach AKS1 only from certain networks and want to minimize effort, enabling authorized IP ranges is the targeted, built-in solution. (Option A)

Why the Other Options Are Wrong

  • Option B (Application Gateway Ingress Controller) manages ingress traffic to workloads, not administrative access to the API server.
  • Option C (Private endpoint) is a connectivity mechanism; it does not by itself restrict access to specific admin networks and adds setup overhead.
  • Option D (Private cluster) places the API server on a private network, which is heavier to operate than simply allowlisting IP ranges and is not the minimal-effort answer the question seeks.

Community Comment Notes

Top comment (9 likes) cited the AKS authorized-IP-ranges doc: 'authorized IP address ranges restricts access to specific IP addresses,' confirming A.

Official Reference

https://learn.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges

This link opens the official vendor documentation in a new tab.

Community Votes

A
57%
C
43%

57% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Codelawdepp 👍 9
    correct answer is A: "authorized IP address ranges " restricts access to specific IP addresses for reference: https://learn.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges?tabs=azure-cli B: an Application Gateway Ingress Controller (AGIC): No because it's manages ingress traffic via Azure Application Gateway. C. a private endpoint: No because it's establishes a private connection through the Azure network. D. a private cluster: No because it's limits API server access to a private virtual network.
  2. dc864d4 👍 5
    This was on the test 5/25/2024
  3. JovenesPromesasMS 👍 2 Answered C
    https://learn.microsoft.com/en-us/azure/aks/private-clusters?tabs=azure-portal
  4. Viggy1212 👍 1 Answered A
    By using a private cluster, you can ensure network traffic between your API server and your node pools remains only on the private network. Source : https://learn.microsoft.com/en-us/azure/aks/private-clusters?tabs=default-basic-networking%2Cazure-portal Question is about ensuring that administrators can access AKS1 only from specific networks, which means you have to use "authorized IP address ranges"
  5. JBAnalyst 👍 1 Answered C
    Private endpoint https://learn.microsoft.com/en-us/azure/aks/private-clusters?tabs=default-basic-networking%2Cazure-portal#use-a-private-endpoint-connection
Show 2 more comments
  1. cassucena 👍 1 Answered A
    "authorized IP address ranges " restricts access to specific IP addresses, private enpoints lets you connect with ip that has access to the subnet.
  2. St33lth 👍 2 Answered A
    Answer A is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Entra Permissions Management Highly Privileged Roles

S-grade

Cross-tenant access settings for B2B collaboration apply only to Microsoft Entra ID tenants, not to Google or Microsoft accounts

S-grade

Creating an allow list of a partner's cloud apps for your users is configured via Outbound access settings in Cross-tenant access settings

S-grade

Azure Defender for Servers Adaptive Application Controls Support

S-grade

← Back to AZ-500 Study Guide